Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
This rule detects potential malicious process injection originating from web browsers (chrome.exe or msedge.exe) when followed by the creation or access of a hex-named text file in the C:\ProgramData directory within a 5-minute window. This behavior often suggests a staged attack where a browser process is used to inject malicious code, and subsequently reads or interacts with a dropped file used for persistence or command-and-control communication.
Detects instances of CreateRemoteThread API calls targeting sensitive host processes (svchost.exe, explorer.exe, lsass.exe, etc.) where the source process is not a recognized system component. This behavior is indicative of reflective DLL injection, a technique often used to execute code within the address space of a remote process to bypass security controls or user-mode hooks.
Detects process hollowing behavior where a ClickFix-delivered loader payload targets legitimate Windows host processes like explorer.exe or svchost.exe. The detection looks for a combination of memory operations (NtUnmapViewOfSection, WriteProcessMemory, PAGE_EXECUTE_READWRITE allocation) and thread control (SetThreadContext, ResumeThread) indicative of malicious code injection.
Detects signs of process hollowing targeting ServiceModelReg.exe, a technique used by ResiLoader to execute the StealC information stealer. The rule monitors for suspicious cross-process access (high-privilege handles), remote thread creation, and anomalous module loading patterns within the target process.
This rule monitors for indicators of process hollowing or memory injection targeting ServiceModelReg.exe. It correlates suspicious events including the creation of suspended processes, memory writes, remote thread creation, specific debug strings (e.g., RUNPE, PEB patched), and outbound network connections. This approach aims to reduce noise from legitimate use of ServiceModelReg.exe by requiring multiple indicators of malicious behavior.
Detects anomalous process injection behavior characteristic of the Turb00 operation (e.g., Go-loader/HijackLoader variants). The rule identifies a two-stage signal: first, the mapping of an unbacked or unusually named executable image into a process before the loading of ntdll.dll; and second, the subsequent invocation of sensitive process manipulation APIs like CreateRemoteThread or SetThreadContext on the same host within a 10-minute window, consistent with process hollowing.
Detects the injection of code into an svchost.exe process from a non-system directory, followed by the loading of .NET CLR runtime modules (clr.dll, clrjit.dll, or mscorlib.ni.dll) within 5 minutes. This pattern often indicates an attempt to execute managed code inside a legitimate system process, potentially to evade security controls. The rule further enriches the finding by identifying if the svchost.exe process is running in a non-standard service group, which serves as a high-confidence signal of anomalous behavior.
Detects multiple signals associated with potential process injection or hollowing involving 'ServiceModelReg.exe'. The rule correlates process creation in a suspended state, memory injection-related actions, outbound network connections from the process, and specific debug strings often associated with automated process hollowing tools.
Detects suspicious cross-process memory injection activity by correlating remote virtual memory allocation (VirtualAllocEx or MapViewOfSection) followed by the creation of a remote thread (CreateRemoteThread) targeting established legitimate Windows processes. This behavior is commonly associated with malware loaders such as Payouts King and RomulusLoader for facilitating code injection.
This rule detects the legitimate Windows filter manager utility, fltMC.exe, performing suspicious activities when launched from temporary directories. It specifically flags cases where fltMC.exe loads modules without a corresponding file path (indicative of reflective DLL injection) or initiates sensitive memory allocation APIs (such as VirtualAllocEx or CreateRemoteThread) that are commonly associated with process hollowing or code injection.
Detects suspicious activity associated with the AdaptixC2 framework, specifically process hollowing or shellcode injection where WmiPrvSE.exe spawns or creates remote threads in WAB.exe (Windows Address Book). This pattern has been observed in Akira ransomware intrusions.
Detects suspicious activities often associated with malware (such as DcRAT or Operation DragonReturn) including the loading of amsi.dll by unauthorized processes in writable directories to facilitate patching of AMSI, and unauthorized cross-process memory writing into svchost.exe from non-system, potentially unsigned or suspicious processes.
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.
This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).
Detects activity associated with the SPECTRALVIPER malware loader, specifically identifying known malicious file hashes (system.config.xml, NotificationConfig.json) and cross-process memory injection patterns (RemoteMemoryAllocation, RemoteMemoryWrite, CreateRemoteThreadApiCall) initiated by specific suspect processes.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects DcRAT (Operation DragonReturn) malware beaconing to a known C2 IP address (223.26.63.40) following the execution of suspicious sideloaded binaries, specifically 'Mixed Reality.exe' or 'COU_ITR-1_to_4_AY2026-27.exe', which then inject malicious code into svchost.exe.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Fraud framework powering scam domains for crypto and gambling schemes
Ransomware group exploiting edge devices and managed file transfer software
Page 10 of 21